WebGoat - Revision history

PSimetzberger at 15:50, 17 December 2024

2024-12-17T15:50:38Z

← Older revision		Revision as of 15:50, 17 December 2024
Line 32:		Line 32:
	** macOS 10.14 or higher		** macOS 10.14 or higher
	** Or any other OS which is supported by Java 17		** Or any other OS which is supported by Java 17
	* Java 17 OR		* Java 17 OR Docker Desktop
	* Docker Desktop
	* Internet Browser of any type		* Internet Browser of any type
	* GIT		* GIT

AIskra: /* WebGoat Lessons */

2024-01-08T15:27:26Z

WebGoat Lessons

← Older revision		Revision as of 15:27, 8 January 2024
Line 92:		Line 92:
	lessons, exercises and challenges. These lessons are divided into different categories and		lessons, exercises and challenges. These lessons are divided into different categories and
	contain several pages of information and exercises. The challenges are more demanding		contain several pages of information and exercises. The challenges are more demanding
	and do not contain any hints. The current version 8.~~2.2~~ contains 10 lessons:		and do not contain any hints. The current version 2023.4 contains 9 lessons:

	* Broken Access Control		* (A1) Broken Access Control (Hijack a session, Insecure Direct Object References, Missing Function Level Access Control and Spoofing an Authenticate Cookie)
	* Cryptographic Failures		* (A2) Cryptographic Failures
	* Injection		* (A3) Injection (SQL Injections intro/advanced/mitigation, Path traversal, Cross Site Scripting)
	* Vuln & Outdated Components		* (A5) Security Misconfiguration (XXE)
	* Identity & Auth Failure		* (A6) Vuln & Outdated Components (Vulnerable Components)
	* Security Logging Failures		* (A7) Identity & Auth Failure (Authentication Bypasses, Insecure Login, JWT tokens, Password reset, Secure Passwords)
	* Server-~~Side~~ Request ~~forgery~~		* (A8) Software & Data Integrity (Insecure Deserialization)
			* (A9) Security Logging Failures (Logging Security)
			* (A10) Server-side Request Forgery (Cross-Site Request Forgeries, Server-side Request Forgery)

	Each lesson contains further sub-chapters which each contain several pages. In the		Each lesson contains further sub-chapters which each contain several pages. In the

AIskra: /* OWASP WebGoat */

2024-01-08T15:05:46Z

OWASP WebGoat

@@ Line 5: / Line 5: @@
 == OWASP WebGoat ==
 The OWASP WebGoat project provides an insecure web application that demonstrates the most common client-side application flaws and explains and tests the vulnerabilities from the OWASP Top 10. Lessons, exercises and challenges are provided to give interested developers hands-on experience to test and better understand the material. When starting each lesson, the user is provided with content and interactive questions about the already explained material or demonstrations of the explained functionality through a dialog from different pages. The learning of the content is thus brought to the user in a playful, hands-on experience. The lessons are structured strictly according to the OWASP Top 10 and can be tested and reviewed individually.
 == Setup ==

AIskra: /* Standalone */

2024-01-08T14:46:57Z

Standalone

← Older revision		Revision as of 14:46, 8 January 2024
Line 35:		Line 35:

	Download .jar file (Java Archive file) from https://github.com/WebGoat/WebGoat/releases		Download .jar file (Java Archive file) from https://github.com/WebGoat/WebGoat/releases
			Make sure that you're downloading the latest version.

	java -Dfile.encoding=UTF-8 -Dwebgoat.port=8080 -Dwebwolf.port=9090 -jar webgoat-2023.8.jar		java -Dfile.encoding=UTF-8 -Dwebgoat.port=8080 -Dwebwolf.port=9090 -jar webgoat-2023.8.jar

AIskra: /* Standalone */

2024-01-08T14:46:01Z

Standalone

← Older revision		Revision as of 14:46, 8 January 2024
Line 36:		Line 36:
	Download .jar file (Java Archive file) from https://github.com/WebGoat/WebGoat/releases		Download .jar file (Java Archive file) from https://github.com/WebGoat/WebGoat/releases

	java -Dfile.encoding=UTF-8 -Dwebgoat.port=8080 -Dwebwolf.port=9090 -jar webgoat-8~~.2.3~~.jar		java -Dfile.encoding=UTF-8 -Dwebgoat.port=8080 -Dwebwolf.port=9090 -jar webgoat-2023.8.jar

	==== Run from the sources ====		==== Run from the sources ====

AIskra: /* Run with Docker */

2024-01-08T14:41:16Z

Run with Docker

← Older revision		Revision as of 14:41, 8 January 2024
Line 30:		Line 30:

	sudo apt install docker.io		sudo apt install docker.io
	sudo docker run ~~-it -p 127.0.0.1:80:8888~~ -p 127.0.0.1:8080:8080 -p 127.0.0.1:9090:9090 -e TZ=Europe/Amsterdam webgoat/~~goatandwolf:v8.2.2~~		sudo docker run -p 127.0.0.1:8080:8080 -p 127.0.0.1:9090:9090 -e TZ=Europe/Amsterdam webgoat/webgoat

	==== Standalone ====		==== Standalone ====

JKasser at 15:21, 2 January 2023

2023-01-02T15:21:18Z

← Older revision		Revision as of 15:21, 2 January 2023
Line 72:		Line 72:
	To gain access to the lessons and challenges, you need to register.		To gain access to the lessons and challenges, you need to register.

	=== WebGoat Lessons ===		== WebGoat Lessons ==

	The OWASP WebGoat Lessons are embedded in the WebGoat Tool. Here, various attack vectors are demonstrated using hands-on examples. In general, WebGoat contains		The OWASP WebGoat Lessons are embedded in the WebGoat Tool. Here, various attack vectors are demonstrated using hands-on examples. In general, WebGoat contains

JKasser at 15:21, 2 January 2023

2023-01-02T15:21:00Z

← Older revision		Revision as of 15:21, 2 January 2023
Line 22:		Line 22:
	* Internet Browser of any type		* Internet Browser of any type
	* GIT		* GIT

	~~=== Description ===~~
	WebGoat is a deliberately insecure web application maintained by OWASP designed to teach web application security lessons. It is a demonstration of common server-side application flaws. The exercises are intended to be used by people to learn about application security and penetration testing techniques.<ref>WebGoat Github, ''WebGoat'', 2022, accessed on: 08.01.2022. [Online]. Available: https://github.com/WebGoat/WebGoat</ref>

	=== Installation Instructions ===		=== Installation Instructions ===

JKasser at 15:20, 2 January 2023

2023-01-02T15:20:11Z

@@ Line 65: / Line 65: @@
-== Access ==
+=== Access ===
 * The landing page will be located at: http://localhost
 * WebGoat will be located at: http://localhost:8080/WebGoat
@@ Line 75: / Line 75: @@
 To gain access to the lessons and challenges, you need to register.
 == References ==

JKasser at 14:17, 2 January 2023

2023-01-02T14:17:32Z

← Older revision		Revision as of 14:17, 2 January 2023
Line 26:		Line 26:
	WebGoat is a deliberately insecure web application maintained by OWASP designed to teach web application security lessons. It is a demonstration of common server-side application flaws. The exercises are intended to be used by people to learn about application security and penetration testing techniques.<ref>WebGoat Github, ''WebGoat'', 2022, accessed on: 08.01.2022. [Online]. Available: https://github.com/WebGoat/WebGoat</ref>		WebGoat is a deliberately insecure web application maintained by OWASP designed to teach web application security lessons. It is a demonstration of common server-side application flaws. The exercises are intended to be used by people to learn about application security and penetration testing techniques.<ref>WebGoat Github, ''WebGoat'', 2022, accessed on: 08.01.2022. [Online]. Available: https://github.com/WebGoat/WebGoat</ref>

	== Installation Instructions ==		=== Installation Instructions ===

	=== Run with Docker ===		==== Run with Docker ====

	Need to insall Docker first, then you can install WebGoat as Docker Image.		Need to insall Docker first, then you can install WebGoat as Docker Image.
Line 35:		Line 35:
	sudo docker run -it -p 127.0.0.1:80:8888 -p 127.0.0.1:8080:8080 -p 127.0.0.1:9090:9090 -e TZ=Europe/Amsterdam webgoat/goatandwolf:v8.2.2		sudo docker run -it -p 127.0.0.1:80:8888 -p 127.0.0.1:8080:8080 -p 127.0.0.1:9090:9090 -e TZ=Europe/Amsterdam webgoat/goatandwolf:v8.2.2

	=== Standalone ===		==== Standalone ====

	Download .jar file (Java Archive file) from https://github.com/WebGoat/WebGoat/releases		Download .jar file (Java Archive file) from https://github.com/WebGoat/WebGoat/releases
Line 41:		Line 41:
	java -Dfile.encoding=UTF-8 -Dwebgoat.port=8080 -Dwebwolf.port=9090 -jar webgoat-8.2.3.jar		java -Dfile.encoding=UTF-8 -Dwebgoat.port=8080 -Dwebwolf.port=9090 -jar webgoat-8.2.3.jar

	=== Run from the sources ===		==== Run from the sources ====

	Clone GitHub Repository (Open Source)		Clone GitHub Repository (Open Source)